Stream: git-wasmtime

Topic: wasmtime / PR #14482 Cap host allocations in `write_zeros...

Wasmtime GitHub notifications bot (Oct 02 2026 at 15:59):

alexcrichton opened PR #14482 from alexcrichton:cap-write-zeros to bytecodealliance:main:

This commit builds on the mitigation applied for GHSA-852m-cvvp-9p4w in #12652. In that PR write_zeros was limited, but only to the return value of check_write. Notably the SinkOutpuStream helper within wasmtime-wasi would yield usize::MAX for the check_write value and effectively ignore the mitigation. The fix here is to reduce the magnitude of values returned by check_write. This additionally audits all preexisting check_write calls and fixes a case in wasi:tls where the return value was 1GB as well. All values are now capped at the previously capped read buffer value of 64k.

part of https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r
<!--
Please make sure you include the following information:

• If this work has been discussed elsewhere, please include a link to that
  conversation. If it was discussed in an issue, just mention "issue #...".

• Explain why this change is needed. If the details are in an issue already,
  this can be brief.

Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.html

Please review the Bytecode Alliance's AI tool usage policy at
https://github.com/bytecodealliance/governance/blob/main/AI_TOOL_POLICY.md

Please ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->

Wasmtime GitHub notifications bot (Oct 02 2026 at 15:59):

alexcrichton requested pchickey for a review on PR #14482.

Wasmtime GitHub notifications bot (Oct 02 2026 at 15:59):

alexcrichton requested wasmtime-wasi-reviewers for a review on PR #14482.

Wasmtime GitHub notifications bot (Oct 02 2026 at 15:59):

alexcrichton requested wasmtime-core-reviewers for a review on PR #14482.

Wasmtime GitHub notifications bot (Oct 02 2026 at 15:59):

:thumbs_up: adamrk submitted PR review.

Wasmtime GitHub notifications bot (Oct 02 2026 at 16:01):

alexcrichton has enabled auto merge for PR #14482.

Wasmtime GitHub notifications bot (Oct 02 2026 at 16:16):

alexcrichton added PR #14482 Cap host allocations in write_zeros for some streams to the merge queue.

Wasmtime GitHub notifications bot (Oct 02 2026 at 16:55):

github-merge-queue[bot] removed PR #14482 Cap host allocations in write_zeros for some streams from the merge queue.

Wasmtime GitHub notifications bot (Oct 02 2026 at 17:00):

alexcrichton added PR #14482 Cap host allocations in write_zeros for some streams to the merge queue.

Wasmtime GitHub notifications bot (Oct 02 2026 at 17:46):

github-actions[bot] added the label wasi on PR #14482.

Wasmtime GitHub notifications bot (Oct 02 2026 at 17:46):

github-actions[bot] added the label wasmtime:c-api on PR #14482.

Wasmtime GitHub notifications bot (Oct 02 2026 at 18:10):

:check: alexcrichton merged PR #14482.

Wasmtime GitHub notifications bot (Oct 02 2026 at 18:10):

alexcrichton removed PR #14482 Cap host allocations in write_zeros for some streams from the merge queue.

Last updated: Oct 11 2026 at 04:10 UTC